CVE-2018-0114

此存储库没有 README。...

CVE-2018-0114

此存储库没有 README。...

jwt-spoof-tool

jwt-spoof-tool 工具描述 : 我制作这个工具是为了学习目的，并自动化 jwt 令牌劫持，而无需依赖 使用 burpsuite 代码有完善的文档，且易于理解 基于 CVE-2018-0114 该漏洞之所以发生，是因为在后端，服务器会检查嵌入在 jwt 标头中的 jwk 对象，其中包含 n 和 e，它们是用于构成公钥的 2 个参数 如何利用 : 1 攻击者生成新的 RSA 密钥对， 2 获取 n 和 e，并将它们注入到 jwt 标头中的 jwk 对象内 3 更改 jwt 正文部分中的任意值，然后用其私钥签名 4 服务器使用攻击者的公钥来验证签名 。 5...

CVE-2018-0114

creationtimestamp| type| source ---|---|--- 2023-08-02 10:00:03+00:00| seen| https://t.me/ptsoft/21 2023-08-02 10:00:03+00:00| seen| https://t.me/ptsoft/12 2024-10-11 07:45:56+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/64 2025-01-28 13:54:03+00:00|...

@ciscospark/internal-plugin-board (>=1.0.0, <=1.28.2), @ciscospark/internal-plugin-calendar (>=1.0.0, <=1.28.2) +37 more potentially affected by CVE-2018-0114 via node-jose (>=0.9.4, <=0.10.0)

node-jose NPM version =0.9.4, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.7.0, =0.7.92, =0.7.0, =0.7.71, =0.7.0, =0.7.0, =0.7.0, =0.1.137, =0.1.207 and more Source cves: CVE-2018-0114 Source advisory: OSV:GHSA-JFXM-W8G2-4RCV...

Cisco node-jos Resign Tokens Proof Of Concept

import base64 import urllib import rsa import sys zi0Black ''' POC of CVE-2018-0114 Cisco node-jose 0.11.0 Created by Andrea Cappa aka @zi0Black GitHub,Twitter,Telegram Mail: [email protected] Site: https://zioblack.xyz A special thanks to Louis Nyffenegger, the founder of PentesterLab, for al...

Cisco node-jos < 0.11.0 - Re-sign Tokens

!/usr/bin/env python3 import base64 from urllib.parse import quoteplus import rsa import sys zi0Black ''' EDB Note: This has been updated https://github.com/offensive-security/exploitdb/pull/139 POC of CVE-2018-0114 Cisco node-jose = 8 return b::-1 def generateheaderpayloadpayload,pubkey: create...

Cisco node-jos < 0.11.0 - Re-sign Tokens Exploit

Exploit for multiple platform in category web applications import base64 import urllib import rsa import sys zi0Black ''' POC of CVE-2018-0114 Cisco node-jose 0.11.0 Created by Andrea Cappa aka @zi0Black GitHub,Twitter,Telegram Mail: email protected Site: https://zioblack.xyz A special thanks to...

CVE-2018-0114

CVE-2018-0114 affects the Cisco node-jose library prior to 0.11.0. The flaw arises when a JSON Web Signature (JWS) header can carry a JWK (public key) that is then trusted for verification. An unauthenticated, remote attacker could forge valid JWS objects by removing the original signature, inser...